The vulnerability half is the stronger one: cve_lookup returns EPSS and KEV status next to the CVSS scores, and cves_by_product filters to known-exploited entries and sorts by EPSS, which is the ordering that decides what gets patched this week rather than next quarter. Both DNS tools take batches, so a list of hostnames costs one call instead of one per name. Every tool here reads; nothing in this list changes anything.
A server over Shodan's host data and its CVEDB, seven tools covering IP and DNS lookups, device search and vulnerability queries.
- An IP resolved to geolocation, open ports, running services, SSL certificates, hostnames and cloud provider, with service banners and HTTP server details where they exist
- Shodan's device search with its own filters, returning matching devices, their vulnerabilities and country-based statistics
- A CVE with CVSS v2 and v3 scores, EPSS probability and ranking, KEV status, proposed mitigations, ransomware associations and affected CPEs
- Vulnerabilities for a product or a CPE 2.3 identifier, filtered to known-exploited entries, sorted by EPSS, bounded by date and paged
- CPE entries searched by product name, returned in full or as a count when you only need the size of the problem
- Forward and reverse DNS for many hostnames or addresses in a single query, with the cases that resolved to nothing marked rather than dropped
SHODAN_API_KEY for a Shodan account. The vulnerability tools query Shodan's CVEDB, so they answer for product names and CPE 2.3 identifiers rather than for a host you point at them.
One command plus a key — npm install -g @burtthecoder/mcp-shodan, then supply credentials